Описание
The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
Отчет
This issue did not affect the versions of php and php53 as shipped with Red Hat Enterprise Linux 5 and the versions of php as shipped with Red Hat Enterprise Linux 6 and 7.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | php | Not affected | ||
| Red Hat Enterprise Linux 5 | php53 | Not affected | ||
| Red Hat Enterprise Linux 6 | php | Not affected | ||
| Red Hat Enterprise Linux 7 | php | Not affected | ||
| Red Hat OpenShift Enterprise 2 | php | Not affected | ||
| Red Hat Software Collections | php54-php | Not affected | ||
| Red Hat Software Collections | php55-php | Not affected | ||
| Red Hat Software Collections | rh-php56-php | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS2
Связанные уязвимости
The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
The php_str_replace_in_subject function in ext/standard/string.c in PH ...
The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
Уязвимость интерпретатора PHP, позволяющая нарушителю выполнить произвольный код
EPSS
5.8 Medium
CVSS2